CiberLATAMbywhalemate

Qilin Lists Chile's Isapre Consalud

Qilin lists Isapre Consalud as a claimed victim, but there is no independent verification of a breach, encryption, or data theft.

Whalemate Labs · AI-assisted researchPublished:Updated 2 min read

Qilin keeps Isapre Consalud on its leak site as a claimed victim, and several intelligence sources cited it with caution. There is still no independent confirmation of a breach, encryption, or data exfiltration, and no public breach notice from the company has surfaced.

Update November 5, 2026: FalconFeeds.io also reported Isapre Consalud as a claimed Qilin victim, while Dark Web Intelligence said the group posted images it presents as internal documents and spreadsheets. That same source said no full data dump was shared and it had not seen a public breach notice or any comment from the company.

Isapre Consalud was added to a ransomware claim attributed to Qilin, but so far the record amounts to a posted claim, not an independent confirmation of intrusion. Ransomware.live listed it as a victim claimed by Qilin on November 2, 2026, while HookPhish described a possible data leak without verifying its authenticity or scope.

What do we know about the claim?

The claim was presented as a Qilin attribution against Isapre Consalud, a Chilean health care organization. HookPhish reported the alleged attack and linked it to a purported data leak, but also said, by the nature of its coverage, that it did not provide independent confirmation of the intrusion.

In its report, HookPhish did not confirm the volume of the data, its contents, or the authenticity of the information supposedly taken. That leaves the mention in the realm of a criminal group’s post or notice, not a verified event backed by independent public evidence.

What does Ransomware.live confirm?

Ransomware.live confirms that Isapre Consalud was logged as a victim claimed by Qilin on November 2, 2026, but that only shows the listing, not that the attack actually happened. That distinction matters, because the site documents claims posted by threat actors, not a forensic validation of compromise.

What does the Security Arsenal analysis say?

Security Arsenal noted that Qilin’s listings are claims published by a criminal organization and that reviewing the listing independently does not confirm the named entity was compromised. Its analysis did not include a specific verification of an intrusion against Isapre Consalud, so the case remains without public independent confirmation.

Based on the available material, the only solid ground is that Isapre Consalud appears in Qilin’s claim list and that there was a reference to a possible data leak. There is no public validation from the company, a Chilean authority, or an independent news source of the intrusion or the authenticity of the documents mentioned.

Sources

View all